---
title: "Create a live query"
method: POST
path: "/api/osquery/live_queries"
tags: ["Security Osquery API"]
---

# Create a live query

`POST /api/osquery/live_queries`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Create and run a live query.

## Request body

- SecurityOsqueryAPICreateLiveQueryRequestBody
  - `agent_all` boolean — When `true`, the query runs on all agents.
  - `agent_ids` string[] — A list of agent IDs to run the query on.
  - `agent_platforms` string[] — A list of agent platforms to run the query on.
  - `agent_policy_ids` string[] — A list of agent policy IDs to run the query on.
  - `alert_ids` string[] — A list of alert IDs associated with the live query.
  - `case_ids` string[] — A list of case IDs associated with the live query.
  - `ecs_mapping` SecurityOsqueryAPIECSMapping — Map osquery results columns or static values to Elastic Common Schema (ECS) fields
  - `event_ids` string[] — A list of event IDs associated with the live query.
  - `metadata` object, nullable — Custom metadata object associated with the live query.
  - `pack_id` string — The ID of the pack.
  - `queries` SecurityOsqueryAPIArrayQueriesItem[] — An array of queries to run.
    - `ecs_mapping` SecurityOsqueryAPIECSMapping — Map osquery results columns or static values to Elastic Common Schema (ECS) fields
    - `id` string — The ID of the query.
    - `platform` string — Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.
    - `query` string — The SQL query you want to run.
    - `removed` boolean — Indicates whether the query is removed.
    - `snapshot` boolean — Indicates whether the query is a snapshot.
    - `version` string — Uses the Osquery versions greater than or equal to the specified version string.
  - `query` string — The SQL query you want to run.
  - `saved_query_id` string — The ID of a saved query.

## Response `200`

Indicates a successful call.

- SecurityOsqueryAPICreateLiveQueryResponse — The response for creating a live query.
  - `data` object, required
    - `@timestamp` string, date-time — The timestamp when the action was created.
    - `action_id` string, required — The ID of the action.
    - `agent_all` boolean — Whether the query targets all agents.
    - `agent_ids` string[] — The agent IDs targeted by the action.
    - `agent_platforms` string[] — The agent platforms targeted.
    - `agent_policy_ids` string[] — The agent policy IDs targeted.
    - `agents` string[] — The resolved list of agent IDs.
    - `expiration` string, date-time — The expiration date of the action.
    - `input_type` string — The input type.
    - `metadata` object — Custom metadata associated with the action.
    - `pack_id` string — The pack ID if the query was run from a pack.
    - `queries` object[] — The queries in this action.
      - `action_id` string
      - `agents` string[]
      - `ecs_mapping` SecurityOsqueryAPIECSMapping — Map osquery results columns or static values to Elastic Common Schema (ECS) fields
      - `id` string
      - `platform` string
      - `query` string
      - `saved_query_id` string
      - `timeout` integer
      - `version` string
    - `type` string — The action type.
    - `user_id` string — The user who created the action.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)